CVE-2024-21137

What it actually does

The flaw in the MySQL Server Optimizer component permits a high-privileged network attacker to trigger repeated crashes or hangs, resulting in complete denial of service for the database instance.

Why it matters to the business

Successful exploitation leads to unplanned database downtime, interrupting applications and services that depend on MySQL for data operations and potentially affecting business continuity until the service is restarted.

How an attack unfolds

An attacker with high-privileged network credentials authenticates to the MySQL Server via supported protocols and submits crafted queries that abuse the Optimizer, forcing the server process to hang or crash repeatedly.

How to fix it

Apply the latest MySQL Server patches that resolve the Optimizer vulnerability; upgrade all affected installations beyond version 8.0.35 and 8.2.0 to the vendor's fixed releases and verify the update through release notes.

How to confirm the fix worked

Confirm the installed MySQL version is newer than the affected releases, review release notes for the specific fix, and test that crafted Optimizer queries no longer cause crashes in a non-production environment.

Typical attack path

1. Obtain high-privileged network credentials for a MySQL instance
2. Establish an authenticated connection using one of the supported protocols
3. Submit specially crafted queries targeting the Optimizer component
4. Observe repeated server hangs or crashes that deny service to legitimate users

How to detect it

Examine MySQL error logs and crash reports for repeated Optimizer-induced hangs or terminations; correlate with authentication events from high-privileged accounts showing unusual query patterns.

What your security team should do

• Prioritize patching all MySQL 8.0.x and 8.2.x instances to the latest fixed versions
• Restrict network access to MySQL ports to only trusted administrative hosts
• Review and minimize the number of high-privileged database accounts with network access
• Monitor database error and crash logs for repeated Optimizer-related failures